AIZK

AIZK gives every person, team, and AI agent one shared memory that stays sourced, scoped, searchable, and aware of time.

Comment

Inspiration

Most agent memory is a vector index filled with detached text. It can find a similar paragraph, but it cannot always explain who wrote it, who can read it, or whether it is still true. That becomes a serious problem when several people and agents share one memory. AIZK preserves the original source, record changes instead of overwriting them, and apply the same access boundary to keyword, vector, graph, and temporal retrieval.

These ideas were inspired by several existing tools and research papers, which we comment in https://xpc3f5mjuv5edgnsfsfbffcoda0ckvij.lambda-url.ap-southeast-1.on.aws/docs/dev/prior-art/comparison/

What AIZK does

AIZK gives MCP agents 4 memory tools:

  1. keep stores a note, public source, or bounded file.
  2. find retrieves evidence even when the question uses different wording.
  3. status reports identity, usage, and processing health.
  4. share moves approved memories into team scopes.

A source excerpt carries its document handle, derived graph knowledge is identified separately, a privacy receipt states whether the public web was consulted and Row Level Security keeps personal memory private and allows controlled sharing with Logto organizations.

How we built it

CockroachDB Cloud is the system of record. It stores source revisions, chunks, embeddings, temporal facts, graph claims, authorization scopes, usage counters, and the durable work queue. C-SPANN Distributed Vector Indexing searches a private scope-keyed vector projection. The result is then hydrated from ordinary row-secured tables, so vector speed does not bypass authorization.

One AWS Lambda serves the website, documentation, browser interface, HTTP API, and modern MCP endpoint through a Lambda Function URL. A second Lambda drains the CockroachDB queue, converts files, embeds chunks, and extracts graph claims. Amazon S3 preserves private original files. EventBridge Scheduler wakes recovery work, ECR stores immutable images, SSM Parameter Store holds secrets, and CloudWatch provides short-retention operational evidence.

Logto provides OAuth and organization membership. The public MCP clients use PKCE and hold no shared secret. OpenRouter routes the bounded demonstration workload to hosted extraction and embedding models.

Challenges we ran into

A direct scoped C-SPANN query took only a few milliseconds, but an ordinary vector filter combined with row level security could force a scan without the index. The full find statement then spent many seconds evaluating parent visibility and composing graph evidence.

We solved the candidate-search problem with a private vector projection keyed by vector kind and exact scope. A capability function validates the requested scope against transaction authority before issuing the C-SPANN query.

Lambda exposed a separate bug. An async database pool was reused across different event loops in warm worker invocations. The worker now keeps one event loop for the life of the Lambda environment, while each function keeps one bounded database connection.

OAuth also required careful testing because the stable AWS URL, Logto resource, callback address, and MCP client had to agree exactly. We replaced an embedded proxy with direct Logto token verification and tested the flow from isolated Codex and OpenCode containers.

Accomplishments that we're proud of

  • The live scoped C-SPANN plan selected the distributed vector index and executed in 7 milliseconds.
  • The bounded six-note cloud workload produced 40 facts, 19 entities, and four communities with no retained queue failure.
  • Warm end-to-end recall measured a 2.14 second median and a 3.16 second p95 on the recorded cloud workload.
  • The same workload answered all 29 expected points after semantic review while preserving the unchanged 26 of 29 exact-phrase score.
  • CloudWatch reported no Lambda errors or throttles during the measured run.
  • Direct Logto OAuth, all five MCP tools, private S3 upload, worker extraction, and grounded recall work from one public AWS URL.
  • The public repository includes the complete infrastructure, migrations, documentation, bounded corpus, redacted query plans, and machine-readable result files.

What we learned

Persistent memory is a database problem before it is a model problem. Vectors can find related text, but useful memory also needs provenance, authorization, time, correction, and durable work state. We also learned that a fast vector index does not guarantee a fast memory request.

What's next for AIZK

The next database pass will reduce the cost of the composed CockroachDB recall statement while preserving the source, community, entity, graph, and authorization behavior demonstrated here. We also want to contribute the reusable PostgreSQL row security DDL building blocks upstream to SQLAlchemy and keep the CockroachDB integration as small as possible.

Visual embeddings remain to be done. Broader benchmarks and larger public corpora also need their own measured studies.

Built With

Share this project:

Updates